Sloth-ninja clears phantom connectors out of the shop window

Owner decision 13/08/2026: neither was part of the UK-legal shortlist
rationale, and both were marked availability:"oauth" with "VERIFIED"
comments that nothing ever verified - the gallery rendered a live
Connect button that dead-ended for pilot users. Delete both entries
outright.

Removing a previously-valid registry id exposes a real gap: the admin
connector-gallery curation PATCH validated every incoming id against
the live registry and 400'd the whole write on an unknown one. Since
the admin UI round-trips its full tick-list on every toggle (with no
control to un-tick a row the registry no longer renders), a firm that
had curated canva/apollo would be permanently blocked from saving any
future connector-gallery change. parseConnectorCuration now silently
drops unknown string ids (still 400s on genuinely malformed,
non-string entries), matching the read-side tolerance
filterRegistryByOrgCuration already has.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PATCH /user/profile accepted and unconditionally wrote the legacy
free-text `organisation` field. A sibling frontend PR hides the input
for firm members; this is the server-side belt.

When the caller has a non-null organisation membership, the
organisation key is now silently dropped from the update before it
reaches the DB - not rejected with a 4xx, since the field is cosmetic
(absence-not-disabled precedent, WS8 PR B). Other fields in the same
PATCH still apply. Fails OPEN on a membership-lookup error: this is a
non-destructive cosmetic write, so availability wins (WS8 PR B
precedent, not the deletion fail-SAFE direction). Orgless callers are
unaffected. The membership lookup only runs when the payload actually
touches `organisation`, avoiding an extra query on unrelated PATCHes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review finding (Minor 1): the stored enabledConnectorIds were returned
unfiltered, so a firm that had curated a since-removed registry entry
(e.g. canva/apollo, removed 13/08/2026) would see it echoed back. This
inflates the admin card's tick count - its "all visible" footer
compares visible.size === registry.length, so a phantom stale id makes
that comparison false while a real entry stays effectively hidden from
the count - and a curation stored as ONLY stale ids would let an
untick compute a payload the server canonicalises to [] ("all
visible"), inverting the admin's intent.

Filters the stored list against connectorRegistryIds() before
returning, mirroring the write-side tolerance already applied to
PATCH /admin/connector-gallery.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review finding (Minor 2): the "does not resolve membership when payload
has no organisation key" test used a bare closure for the
resolveUserOrganisation mock, so it recorded nothing and the test would
pass under any implementation - the claim was never actually checked.

Replaces the closure with a vi.fn() spy (call-through pattern matching
user.connectorGallery.test.ts) and asserts exact call counts: a
displayName-only PATCH resolves membership exactly once (loadProfile's
own resolve for the response's `firm` field), an organisation-touching
PATCH exactly twice (the belt's resolve + loadProfile's).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Connector-registry honesty (Canva/Apollo removed, owner decision
13/08) + firm-member organisation-write belt, including the two
review-round fixes (PATCH silent-drop, GET read-side stale-id filter).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>